CVE-2024-40767

What it actually does

Authenticated users can supply a raw-format disk image that is actually a crafted QCOW2 or VMDK file containing a backing-file or descriptor path; Nova follows the embedded path and returns the referenced file contents from the server, enabling unauthorized file reads.

Why it matters to the business

Attackers with valid credentials may obtain sensitive configuration files, credentials, or other data stored on compute nodes, increasing risk of further compromise and potential operational disruption across all Nova-based cloud deployments.

How an attack unfolds

An authenticated user creates a malicious QCOW2 or VMDK image embedding a path to a target file, uploads or references it as a raw-format image during instance creation or image registration, and Nova's image handling code follows the path and returns the file contents to the user.

How to fix it

Upgrade OpenStack Nova to 27.4.1 or later, 28.2.1 or later, or 29.1.1 or later. Until patches can be applied, restrict image upload and registration privileges and enforce strict validation of image formats and backing paths.

How to confirm the fix worked

Confirm Nova services are running patched versions, review image-handling code for the presence of the prior incomplete fixes, and test that crafted QCOW2/VMDK images no longer return arbitrary file contents.

Typical attack path

1. Obtain valid OpenStack credentials
2. Craft QCOW2 or VMDK image with malicious backing-file or descriptor path
3. Register or boot an instance using the crafted image presented as raw format
4. Receive contents of the referenced server-side file in the response

How to detect it

Review Nova compute and API logs for image registration or instance creation events that specify raw format yet reference QCOW2 or VMDK structures; correlate with unexpected file-access patterns on compute hosts.

What your security team should do

• Apply the listed Nova version upgrades immediately on all deployments
• Audit and tighten image upload and Glance integration permissions
• Monitor for unusual image registration or instance creation events involving raw format
• Re-test any prior mitigations applied for CVE-2022-47951 and CVE-2024-32498